Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 01:50
Static task
static1
Behavioral task
behavioral1
Sample
f93df5b9d273ec9921943e36de014dfc_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f93df5b9d273ec9921943e36de014dfc_JaffaCakes118.exe
-
Size
759KB
-
MD5
f93df5b9d273ec9921943e36de014dfc
-
SHA1
95d42a9e6c989ebd15b24c2ae997b142f5c063cd
-
SHA256
194c939150cd885553cc6e02f1c8dbe5fb7bf327556245d76d6ea165ec959670
-
SHA512
4fd5fbc6cd08367de3bbf71d05dd5ef0dd205ee8655b4511ff6249db2d47870a8173fee158a66bab55d8bcf5c02cb4f402584d23274fd8184d24264657e60cf0
-
SSDEEP
12288:afyWzL1hFtK0pMQS3NRLSbL/3PiSQ9GLLsHBsVIdEJ6p206Z0yY9qigKekeqn/:sL1hFtK+9vPc9G4BsZP0RyABePqn/
Malware Config
Extracted
cryptbot
smarew72.top
moriwi07.top
-
payload_url
http://guruzo10.top/download.php?file=lv.exe
Signatures
-
CryptBot payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2132-2-0x0000000001DD0000-0x0000000001EB1000-memory.dmp family_cryptbot behavioral1/memory/2132-3-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot behavioral1/memory/2132-7-0x0000000001DD0000-0x0000000001EB1000-memory.dmp family_cryptbot behavioral1/memory/2132-6-0x0000000000400000-0x00000000004E5000-memory.dmp family_cryptbot -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f93df5b9d273ec9921943e36de014dfc_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f93df5b9d273ec9921943e36de014dfc_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f93df5b9d273ec9921943e36de014dfc_JaffaCakes118.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2132-2-0x0000000001DD0000-0x0000000001EB1000-memory.dmpFilesize
900KB
-
memory/2132-1-0x00000000002D0000-0x00000000003D0000-memory.dmpFilesize
1024KB
-
memory/2132-3-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB
-
memory/2132-7-0x0000000001DD0000-0x0000000001EB1000-memory.dmpFilesize
900KB
-
memory/2132-6-0x0000000000400000-0x00000000004E5000-memory.dmpFilesize
916KB